Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

If you lead security at an EU financial institution or ICT service provider, the Digital Operational Resilience Act (DORA) is already reshaping your calendar, your budget, and the questions your board is asking. What it should also be reshaping is how you think about your software. Application security for DORA compliance isn’t a discrete project you hand to your development team.

Data masking limits unnecessary exposure when teams copy sensitive production values into testing, analytics, and sharing workflows. It replaces those values with realistic substitutes, but weak implementations still permit inference, linkage, or reversal. Effective programs select techniques based on downstream use and test each output against its intended workflow.

Passkeys make authentication safer by resisting phishing attacks and eliminating shared secrets like passwords that attackers can steal from a website to access your accounts. By removing the secrets from servers, they reduce the risk of data breaches. However, advances in quantum computing threaten to increase the risk of those data breaches yet again by breaking the cryptography passkeys currently use.

The two registers hold different objects, run on different clocks and answer to different people. Where they are treated as one list at different levels of detail, items get counted twice and others fall between them. ‍ A vulnerability register holds findings on assets and numbers in the thousands. A cyber risk register holds loss scenarios and numbers in the tens. Neither is a summary of the other. ‍

Most governance platform comparisons written for financial services lead with the EU AI Act high-risk regime. For a bank deploying credit scoring today, that is the obligation furthest from biting, and the ones already in force get less attention than they deserve. ‍ The criteria below follow the provisions rather than the subject areas, with dates attached, because the sequence they arrive in decides what a platform has to do first. ‍

South Africans who fall victim to cybercrime now have more support available. MiDO Academy, The Cyber Helpline (UK) and Amazon Web Services (AWS) launched the pilot of The Cyber Helpline in South Africa, a free, confidential service providing practical guidance and compassionate support to individuals affected by online fraud, investment and employment scams, hacked accounts, phishing and smishing, social media fake profiles, sextortion, online harassment, identity theft, malware and ransomware incidents.

Keeper Security, the leading zero-trust and zero-knowledge identity security platform, today announces native integrations with Tenable that eliminate the costly delay between identifying cloud security risks and remediating them while centralizing credential management for comprehensive vulnerability assessment. These integrations allow cloud security teams to move from detection to remediation in a single workflow, without managing manual tickets or switching between tools.

The China-based threat group uses DLL sideloading in these attacks Counter Threat Unit (CTU) and SophosLabs researchers investigated a cluster of incidents attributed to the BRONZE SANDCASTLE threat group. The most distinctive technical marker for BRONZE SANDCASTLE is its consistent use of Sandboxie DLL sideloading.